Systems and methods for message threat management
First Claim
1. A management system for generating and distributing threat detection rules to application layer security systems, the system comprising:
- a. a communication interface adapted to allow communication between the management system and at least one application layer security system;
b. a system data store comprising one or more data storage elements, wherein the system data store is capable of storing;
i. one or more sets of threat management goals; and
ii. threat information; and
c. a system processor in communication with the communication interface and the system data store, wherein the system processor comprises one or more processing elements and the one or more processing elements are programmed or adapted to;
i. receive threat information from one or more sources;
ii. reduce the received threat information into a canonical form;
iii. extract features from the reduced threat information;
iv. generate a rule set of one or more threat rules based upon the extracted features and a goal set of one or more threat management goals in the system data store; and
v. transmit the generated rule set to at least one of the plurality of application layer security systems.
14 Assignments
0 Petitions
Accused Products
Abstract
The present invention is directed to systems and methods for detecting unsolicited and threatening communications and communicating threat information related thereto. Threat information is received from one or more sources; such sources can include external security databases and threat information data from one or more application and/or network layer security systems. The received threat information is reduced into a canonical form. Features are extracted from the reduced threat information; these features in conjunction with configuration data such as goals are used to produce rules. In some embodiments, these rules are tested against one or more sets of test data and compared against the same or different goals; if one or more tests fail, the rules are refined until the tests succeed within an acceptable margin of error. The rules are then propagated to one or more application layer security systems.
-
Citations
39 Claims
-
1. A management system for generating and distributing threat detection rules to application layer security systems, the system comprising:
-
a. a communication interface adapted to allow communication between the management system and at least one application layer security system;
b. a system data store comprising one or more data storage elements, wherein the system data store is capable of storing;
i. one or more sets of threat management goals; and
ii. threat information; and
c. a system processor in communication with the communication interface and the system data store, wherein the system processor comprises one or more processing elements and the one or more processing elements are programmed or adapted to;
i. receive threat information from one or more sources;
ii. reduce the received threat information into a canonical form;
iii. extract features from the reduced threat information;
iv. generate a rule set of one or more threat rules based upon the extracted features and a goal set of one or more threat management goals in the system data store; and
v. transmit the generated rule set to at least one of the plurality of application layer security systems. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20-38. -38. (canceled)
-
39. A method for generating and distributing threat detection rules to application layer security systems, the method comprising:
-
receiving threat information from one or more sources comprising application layer security systems, spam databases, a virus information databases, intrusion information databases, or combinations thereof;
reducing the received threat information into a canonical form;
extracting features from the reduced threat information by applying one or more regular expressions;
selecting a goal set of one or more threat management goals based at least in part upon a selected application layer security system from the plurality of application layer security systems, wherein the goal set comprises one or more values of a type comprising effectiveness values, accuracy values, efficiency values, false positive values, or combinations thereof;
generating a candidate rule set of one or more threat rules based upon the extracted features and the goal set;
testing the candidate rule set against one or more sets of test data;
refining the candidate rule set if the evaluation of the rule set fails to satisfy a predetermined confidence level; and
transmitting the candidate or refined rule set to at least one application layer security system.
-
Specification